@celilo/cli 0.11.0-alpha.0 → 0.12.0

package/src/registry/client.ts

@@ -40,6 +40,14 @@ export interface ModuleMetadata {
   versions: Array<{ num: string; yanked: boolean; created_at: string }>;
 }
 
+/** A module-owner table entry (ce-1ch). Mirrors the registry-server shape. */
+export interface ModuleOwner {
+  moduleName: string;
+  ownerSub: string;
+  claimedAt: string;
+  sourceGroup: string;
+}
+
 export class RegistryClient {
   readonly baseUrl: string;
 
@@ -158,10 +166,68 @@ export class RegistryClient {
     return resp.json() as Promise<{ ok: boolean; name: string; vers: string }>;
   }
 
+  // ── Module ownership (admin — ce-1ch) ──────────────────────────────────────
+
+  /** List the whole module-owner table. Requires an admin token. */
+  async listOwners(token: string): Promise<ModuleOwner[]> {
+    const resp = await this.authed(`${this.baseUrl}/api/v1/modules/owners`, token);
+    const body = (await resp.json()) as { owners: ModuleOwner[] };
+    return body.owners;
+  }
+
+  /** Show the owner of one module name, or null if unclaimed. Requires an admin token. */
+  async getOwner(name: string, token: string): Promise<ModuleOwner | null> {
+    const url = `${this.baseUrl}/api/v1/modules/owners/${encodeURIComponent(name)}`;
+    const resp = await fetch(url, {
+      headers: { Authorization: token },
+      signal: AbortSignal.timeout(30_000),
+    });
+    if (resp.status === 404) return null;
+    if (!resp.ok) throw new Error(await this.errorDetail(resp));
+    const body = (await resp.json()) as { owner: ModuleOwner };
+    return body.owner;
+  }
+
+  /** Reassign a module name to `ownerSub` (admin overwrite). Requires an admin token. */
+  async setOwner(name: string, ownerSub: string, token: string): Promise<ModuleOwner> {
+    const url = `${this.baseUrl}/api/v1/modules/owners/${encodeURIComponent(name)}`;
+    const resp = await fetch(url, {
+      method: 'POST',
+      headers: { Authorization: token, 'Content-Type': 'application/json' },
+      body: JSON.stringify({ ownerSub }),
+      signal: AbortSignal.timeout(30_000),
+    });
+    if (!resp.ok) throw new Error(await this.errorDetail(resp));
+    const body = (await resp.json()) as { owner: ModuleOwner };
+    return body.owner;
+  }
+
   // ── Internal ──────────────────────────────────────────────────────────────
 
+  /** GET with an Authorization header, throwing the server's error detail on failure. */
+  private async authed(url: string, token: string): Promise<Response> {
+    const resp = await fetch(url, {
+      headers: { Authorization: token },
+      signal: AbortSignal.timeout(30_000),
+    });
+    if (!resp.ok) throw new Error(await this.errorDetail(resp));
+    return resp;
+  }
+
+  /** Extract `errors[0].detail` from a Cargo-protocol error body, or fall back to the status. */
+  private async errorDetail(resp: Response): Promise<string> {
+    const body = (await resp.json().catch(() => ({}))) as {
+      errors?: Array<{ detail: string }>;
+    };
+    return body.errors?.[0]?.detail ?? `HTTP ${resp.status}`;
+  }
+
   private async get(url: string): Promise<Response> {
-    const resp = await fetch(url, { signal: AbortSignal.timeout(15_000) });
+    // 30s (was 15s): a module .netapp can be tens of MB and the download must
+    // finish within one window. 15s was too aggressive on slow links — the
+    // download of a ~19MB module over a multi-hop path (e2e sim NAT, real WAN)
+    // intermittently timed out mid-transfer.
+    const resp = await fetch(url, { signal: AbortSignal.timeout(30_000) });
     if (!resp.ok) {
       throw new Error(`Registry error at ${url}: HTTP ${resp.status}`);
     }

package/src/services/api-access.ts

@@ -1,5 +1,5 @@
 /**
- * Remote API access control (see v2/API_COMMUNICATION.md, Slice 2a).
+ * Remote API access control (see openspec/changes/replace-ssh-cli-api/proposal.md, Slice 2a).
  *
  * Stores API principals (name + SSH public key + grants), answers authz
  * queries (deny-by-default), and renders the API account's `authorized_keys`

package/src/services/aspect-approvals.ts

@@ -1,7 +1,7 @@
 /**
  * Aspect approvals — operator consent for a module's base-module aspect.
  *
- * Per v2/CELILO_BASE.md D2: when an operator imports a module that
+ * Per openspec/specs/base-module-aspects/spec.md D2: when an operator imports a module that
  * declares a `base_module_aspect`, they consent to that aspect's
  * scope (applicable_zones + triggers) ONCE at import time. The
  * consent is recorded in the `aspect_approvals` table and consulted

package/src/services/aspect-runner.ts

@@ -2,7 +2,7 @@
  * Aspect runner — executes a module's base-module aspect across
  * the fleet.
  *
- * Per v2/CELILO_BASE.md Phase 1: when a module with an approved
+ * Per openspec/specs/base-module-aspects/spec.md Phase 1: when a module with an approved
  * `base_module_aspect` triggers a fan-out event, the runner walks
  * every non-`api_only` system in the aspect's `applicable_zones`,
  * materializes an Ansible inventory + playbook in a scratch
@@ -97,7 +97,7 @@ export interface AspectRunOptions {
   /**
    * Hostnames to exclude from fan-out, on top of `api_only`. The
    * primary deploy's own host(s) typically don't need the aspect
-   * (per v2/CELILO_BASE.md D3 — aspect authors handle this when
+   * (per openspec/specs/base-module-aspects/spec.md D3 — aspect authors handle this when
    * they want it, the framework doesn't force a skip).
    */
   excludeHostnames?: string[];
@@ -301,7 +301,7 @@ export async function materializeAspectAnsible(args: {
 /**
  * Execution-phase function: orchestrates plan + materialize + run.
  *
- * Failure semantics (v2/CELILO_BASE.md D4): aspects are idempotent
+ * Failure semantics (openspec/specs/base-module-aspects/spec.md D4): aspects are idempotent
  * and forward-progress only. A failed fan-out is reported and the
  * partial state (some systems updated, others not) is preserved —
  * no rollback. The caller (deploy planner, in SC4) decides how to

package/src/services/aspect-template-resolver.test.ts

@@ -14,7 +14,7 @@ const TEST_DB_PATH = './test-aspect-resolver.db';
  * resolver (separate from variables/resolver.ts); it previously handled
  * only $self:/$system:/$capability:, so knot's migrated
  * `knot_server_ip: $infra:main.ipv4_address` leaked into resolv.conf
- * unresolved and broke DNS on every fleet machine. v2/MODULE_SYSTEMS_ADDRESSING.md.
+ * unresolved and broke DNS on every fleet machine. openspec/specs/module-systems-addressing/spec.md.
  */
 function seedModuleWithSystem(db: DbClient, moduleId: string, ip: string): void {
   db.insert(modules)

package/src/services/aspect-template-resolver.ts

@@ -59,7 +59,7 @@ export async function resolveAspectTemplate(
   });
 
   // $infra:<system-name>.<field> — the provider's deployed system, by name
-  // (v2/MODULE_SYSTEMS_ADDRESSING.md). This is how an aspect references the
+  // (openspec/specs/module-systems-addressing/spec.md). This is how an aspect references the
   // provider's own host IP (e.g. knot's dns-client-config aspect sets every
   // fleet machine's nameserver to $infra:main.ipv4_address). Without this the
   // literal template string would leak into resolv.conf.

package/src/services/build-bus/delivery-events.ts

@@ -1,7 +1,7 @@
 /**
  * Local-bus event emitters for build-bus delivery outcomes.
  *
- * Phase 6 of [[v2/BUILD_BUS.md]] wants `celilo subscribers status`
+ * Phase 6 of [[openspec/changes/build-bus-poll-cd/proposal.md]] wants `celilo subscribers status`
  * to show last-delivery state + recent failures per subscriber. The
  * data source for that view is the local SQLite event bus — every
  * publisher-side fan-out call emits one `webhook.delivered` or

package/src/services/build-bus/fan-out.ts

@@ -1,5 +1,5 @@
 /**
- * Webhook fan-out for the build bus ([[v2/BUILD_BUS.md]] Phase 2).
+ * Webhook fan-out for the build bus ([[openspec/changes/build-bus-poll-cd/proposal.md]] Phase 2).
  *
  * Given a PublishEvent and a subscriber list, this module:
  *   1. Filters subscribers whose match rule fires for the event.

package/src/services/build-bus/hook-dispatch.ts

@@ -1,6 +1,6 @@
 /**
  * Hook-dispatch planning + execution for the build bus
- * ([[v2/BUILD_BUS.md]] Phase 4).
+ * ([[openspec/changes/build-bus-poll-cd/proposal.md]] Phase 4).
  *
  * Pure: planHookDispatch(event, modules) → HookDispatchPlan[].
  * Decides which module hooks match the event without spawning

package/src/services/build-bus/receiver-server.ts

@@ -1,6 +1,6 @@
 /**
  * HTTP receiver daemon for the build bus
- * ([[v2/BUILD_BUS.md]] Phase 3).
+ * ([[openspec/changes/build-bus-poll-cd/proposal.md]] Phase 3).
  *
  * Verifies signed webhook envelopes against a per-receiver shared
  * secret, then re-emits the contained PublishEvent onto the local

package/src/services/build-bus/status.test.ts

@@ -1,5 +1,5 @@
 /**
- * Status-aggregator tests — Phase 6 of [[v2/BUILD_BUS.md]].
+ * Status-aggregator tests — Phase 6 of [[openspec/changes/build-bus-poll-cd/proposal.md]].
  *
  * The aggregator is pure: takes subscribers + delivery records,
  * returns per-subscriber summaries. The formatter is pure too.

package/src/services/build-bus/status.ts

@@ -1,6 +1,6 @@
 /**
  * Delivery-history aggregator for `celilo subscribers status`
- * ([[v2/BUILD_BUS.md]] Phase 6).
+ * ([[openspec/changes/build-bus-poll-cd/proposal.md]] Phase 6).
  *
  * Reads recent `webhook.delivered` + `webhook.failed` events from
  * the local event bus, groups by subscriber URL, and produces a

package/src/services/build-bus/subscriber-store.ts

@@ -1,6 +1,6 @@
 /**
  * Static-config subscriber store for the build bus
- * ([[v2/BUILD_BUS.md]] Phase 2-lite).
+ * ([[openspec/changes/build-bus-poll-cd/proposal.md]] Phase 2-lite).
  *
  * The first cut of cross-machine event distribution skips the
  * registry-server switchboard described in §6 of the spec — instead

package/src/services/bus-interview.ts

@@ -9,7 +9,7 @@
  * nothing answers, the operator sees the unanswered query via
  * `celilo events list-pending` and fixes the responder setup.
  *
- * See `infra/design/INTERACTIVE_DEPLOYS_VIA_BUS.md`.
+ * See `infra/openspec/changes/interactive-deploys-via-event-bus/proposal.md`.
  */
 
 import { type Bus, defineEvents, openBus } from '@celilo/event-bus';

package/src/services/celilo-events.ts

@@ -64,7 +64,7 @@ export interface UninstallFailedPayload {
  * module) has come up / been torn down. Carries the system's identity so a
  * subscriber (e.g. a dns_internal provider) can register/deregister internal
  * DNS records without re-querying the deploying module's config.
- * v2/INTERNAL_DNS_DHCP_AND_SPLIT_HORIZON.md D5.
+ * openspec/specs/internal-dns-split-horizon/spec.md D5.
  */
 export interface SystemCreatedPayload {
   /** The module whose deploy produced this system (lets handlers resolve zones, etc.). */

package/src/services/celilo-mgmt-hooks.test.ts

@@ -1,6 +1,6 @@
 /**
  * Behavior tests for the celilo-mgmt module's on_backup / on_restore
- * hooks (Phase 3 of v2/SYSTEM_BACKUP_TERRAFORM_STATE.md).
+ * hooks (Phase 3 of openspec/specs/management-server-backup/spec.md).
  *
  * We import the hook scripts directly and call their handlers with a
  * synthesized HookContext, then assert on the side-effects (files

package/src/services/cross-module-read.ts

@@ -1,7 +1,7 @@
 /**
  * Materialization helpers for the `cross_module_read` privilege.
  *
- * Phase 2 of v2/SYSTEM_BACKUP_TERRAFORM_STATE.md. When an allow-listed
+ * Phase 2 of openspec/specs/management-server-backup/spec.md. When an allow-listed
  * module (today: only celilo-mgmt) declares `cross_module_read` in its
  * `requires.capabilities`, its on_backup hook receives a
  * `cross_module_root` input pointing at a directory mirroring OTHER

package/src/services/deploy-posture.ts

@@ -1,6 +1,6 @@
 /**
  * Deploy posture — fast vs. safe — for `celilo module upgrade` (ISS-0138,
- * v2/BUILD_BUS.md).
+ * openspec/changes/build-bus-poll-cd/proposal.md).
  *
  * CD is CI-driven, so no operator is present to pass `--no-backup`. The posture
  * (fast = skip backup + extended verify; safe = backup + full verify) is

package/src/services/deployed-systems.test.ts

@@ -17,7 +17,7 @@ const TEST_DB_PATH = './test-deployed-systems.db';
 
 /**
  * Coverage for the one-time `module_systems` upgrade backfill
- * (v2/MODULE_SYSTEMS_ADDRESSING.md): a deployment created before 0007 has its
+ * (openspec/specs/module-systems-addressing/spec.md): a deployment created before 0007 has its
  * host data in module_configs / ip_allocations / module_infrastructure but an
  * empty module_systems, and the refactored hooks resolve to no system. The
  * backfill reconstructs it. Mirrors the real turnip prod state (caddy etc.:

package/src/services/deployed-systems.ts

@@ -15,7 +15,7 @@ import type { InfraSystemFields } from '../variables/types';
 
 /**
  * The deployment-STATE layer: a module's 0..N deployed systems
- * (v2/MODULE_SYSTEMS_ADDRESSING.md). Replaces the scalar `target_ip`/`vmid`
+ * (openspec/specs/module-systems-addressing/spec.md). Replaces the scalar `target_ip`/`vmid`
  * rows that used to live in module_configs and the single-result
  * `getModuleHostAndIp`. There is deliberately no "get THE system" helper —
  * callers work with the array so the 0/1/N reality stays visible.
@@ -216,7 +216,7 @@ function asZone(value: string | undefined): NetworkZone | null {
  * `requires.system`, normalized to name `main`, or one `requires.systems`
  * entry), so this records that single host from `hostname` config + the
  * resolved IP. Returns the systems it recorded ([] for an API-only module with
- * no host — e.g. namecheap). See v2/MODULE_SYSTEMS_ADDRESSING.md.
+ * no host — e.g. namecheap). See openspec/specs/module-systems-addressing/spec.md.
  */
 export async function recordDeployedSystemForModule(
   moduleId: string,
@@ -282,7 +282,7 @@ export async function recordDeployedSystemForModule(
 
 /**
  * One-time upgrade backfill: populate `module_systems` for deployments that
- * predate `0007_module_systems` (v2/MODULE_SYSTEMS_ADDRESSING.md). A DB created
+ * predate `0007_module_systems` (openspec/specs/module-systems-addressing/spec.md). A DB created
  * before the target_ip → systems refactor has its host data in
  * `module_configs.target_ip` / `vmid` / `zone` + `ip_allocations` +
  * `module_infrastructure`, but an empty `module_systems` — so `$infra:` and
@@ -374,7 +374,7 @@ function prefixOf(subnetCidr: string | undefined): number {
  * Build the `$infra:<name>.<field>` lookup for a module — one entry per deployed
  * system, keyed by its `name`. `cidr` is derived from `ipv4_address` + the
  * zone's prefix (from `network.<zone>.subnet` in system config). Consumed by the
- * variable resolver at generate time. v2/MODULE_SYSTEMS_ADDRESSING.md.
+ * variable resolver at generate time. openspec/specs/module-systems-addressing/spec.md.
  */
 export function buildInfraSystemsMap(
   moduleId: string,

package/src/services/dns-provider-backfill.ts

@@ -7,7 +7,7 @@
  * every currently-deployed system in its zones by invoking its OWN
  * `on_system_event` hook once per host. The ongoing case (a system deploying
  * AFTER the provider) is handled by the provider's `system.created.*`
- * subscription. See v2/EVENT_DRIVEN_HOOK_SUBSCRIPTIONS.md.
+ * subscription. See openspec/specs/event-driven-hook-subscriptions/spec.md.
  *
  * All DNS mechanics (which zones, register vs delete) live in the module's
  * hook; this file only decides WHICH hosts and invokes the hook. That is the
@@ -74,7 +74,7 @@ export async function backfillProviderDns(
   const failures: string[] = [];
 
   // One register per deployed system across all modules — a module with N
-  // hosts backfills N records (v2/MODULE_SYSTEMS_ADDRESSING.md).
+  // hosts backfills N records (openspec/specs/module-systems-addressing/spec.md).
   for (const mod of deployed) {
     for (const sys of getModuleSystems(mod.id, db)) {
       const result = await runNamedHook(moduleId, 'on_system_event' as HookName, db, logger, {

package/src/services/events-daemon.ts

@@ -171,7 +171,7 @@ export function renderSystemdUnit(input: UnitInputs): string {
       : `journalctl --user -u ${SYSTEMD_UNIT_NAME}`;
   return `[Unit]
 Description=Celilo SQLite Event Bus Dispatcher
-Documentation=https://github.com/psbanka/infra/blob/main/design/SQLITE_EVENT_BUS.md
+Documentation=https://github.com/psbanka/infra/blob/main/openspec/specs/event-bus/spec.md
 After=network.target
 
 [Service]

package/src/services/machine-pool.ts

@@ -242,17 +242,17 @@ export async function listMachines(filters?: MachineFilters): Promise<Machine[]>
 /**
  * Return every machine in any of the given zones — the discovery
  * query the aspect runner uses to find fan-out targets per
- * v2/CELILO_BASE.md.
+ * openspec/specs/base-module-aspects/spec.md.
  *
  * Filters:
  * - `excludeApiOnly` (default `true`): drops machines marked
  *   `api_only` (the greenwave / ISP-modem case). Aspects use
- *   Ansible, so api_only systems are unreachable. v2/CELILO_BASE.md
+ *   Ansible, so api_only systems are unreachable. openspec/specs/base-module-aspects/spec.md
  *   D8.
  * - `excludeHostnames` (default `[]`): drops named hostnames.
  *   Aspect authors that need to skip the system running their own
  *   primary deploy pass it here; the framework doesn't auto-skip
- *   (v2/CELILO_BASE.md D3).
+ *   (openspec/specs/base-module-aspects/spec.md D3).
  *
  * NOTE on container_service systems: this Phase 1 implementation
  * covers MACHINE-based systems only (the machines table). LXCs/VMs

package/src/services/module-deploy.ts

@@ -39,6 +39,7 @@ import { E2E_CONFLICT_MESSAGE, runningE2eContainers } from './e2e-guard';
 import { resolveInfrastructureVariables } from './infrastructure-variable-resolver';
 import { findMachineForModule } from './machine-pool';
 import { checkProxmoxReachable, formatProxmoxUnreachableError } from './proxmox-preflight';
+import { republishStaticWebConsumers } from './public-web-republish';
 import { deleteTemporarySshKey, writeTemporarySshKey } from './ssh-key-manager';
 import { buildTerraformEnvForService } from './terraform-env';
 
@@ -335,7 +336,7 @@ async function deployModuleImpl(
   // events and prompts via clack. Other responder shapes (Claude
   // subagent, `celilo events respond` from another shell, autoresponder
   // daemon) compete on the bus; first reply wins. See
-  // infra/design/INTERACTIVE_DEPLOYS_VIA_BUS.md.
+  // infra/openspec/changes/interactive-deploys-via-event-bus/proposal.md.
   const terminalResponder = process.stdin.isTTY
     ? (await import('./terminal-responder')).startTerminalResponder()
     : null;
@@ -772,7 +773,7 @@ async function deployModuleImpl(
 
       // Fan out the module's base-module aspect (if any) per the
       // on_install trigger. Failures here don't fail the primary
-      // deploy — D4 in v2/CELILO_BASE.md: aspects are idempotent
+      // deploy — D4 in openspec/specs/base-module-aspects/spec.md: aspects are idempotent
       // and forward-progress; a partial fleet update is expected to
       // converge on the next fan-out. We log the result instead.
       const aspectOutcome = await maybeRunAspectForTrigger({
@@ -789,6 +790,27 @@ async function deployModuleImpl(
         log.success(`Base-module aspect fan-out for '${moduleId}' completed`);
       }
 
+      // A public_web provider deploy rebuilds its host and takes /srv/www with
+      // it, while consumers' route rows survive — so the fresh provider would
+      // render site blocks pointing at directories that no longer exist. Re-run
+      // each static consumer's on_install to refill them. Idempotent; failures
+      // are logged, never fatal to the provider's own deploy.
+      const republish = await republishStaticWebConsumers({
+        providerModuleId: moduleId,
+        manifest,
+        db,
+      });
+      if (republish.republished.length > 0) {
+        log.success(
+          `Re-published ${republish.republished.length} static site(s) to '${moduleId}': ${republish.republished.join(', ')}`,
+        );
+      }
+      for (const failure of republish.failures) {
+        log.warn(
+          `Failed to re-publish '${failure.moduleId}' to '${moduleId}': ${failure.error}. Run \`celilo module deploy ${failure.moduleId}\` to restore its content.`,
+        );
+      }
+
       // Mirror the infrastructure-path success message at the end of
       // a successful deploy. Without this, config-only deploys end
       // abruptly with whatever the last hook line was — operator sees
@@ -884,7 +906,7 @@ async function deployModuleImpl(
     // Record the module's deployed system(s) now that the IP is known for every
     // provider type (machine / proxmox IPAM / DO outputs). This populates
     // ctx.systems for on_install and is the source of truth for system.created
-    // and DNS (v2/MODULE_SYSTEMS_ADDRESSING.md). API-only modules record none.
+    // and DNS (openspec/specs/module-systems-addressing/spec.md). API-only modules record none.
     {
       const { recordDeployedSystemForModule } = await import('./deployed-systems');
       const recorded = await recordDeployedSystemForModule(
@@ -1170,7 +1192,7 @@ async function deployModuleImpl(
 
         // Inject the machine's IP as ip.primary for hooks that still read it
         // (firewall NAT target, etc.). The host's address for hooks now comes
-        // from ctx.systems (v2/MODULE_SYSTEMS_ADDRESSING.md), recorded into
+        // from ctx.systems (openspec/specs/module-systems-addressing/spec.md), recorded into
         // module_systems during generate — no target_ip is written here.
         if (machineId) {
           const { getMachine } = await import('./machine-pool');
@@ -1235,6 +1257,48 @@ async function deployModuleImpl(
             error: installResult.error,
           };
         }
+
+        // Persist on_install string outputs as secrets on this module — same
+        // as the validate_config / container_created paths above. caddy relies
+        // on this to publish its firewall external IP (`public_ip`) so
+        // public_web.register_route can point a new hostname's public A record
+        // at it (M1 / #328).
+        if (Object.keys(installResult.outputs).length > 0) {
+          const { secrets: st } = await import('../db/schema');
+          const { encryptSecret } = await import('../secrets/encryption');
+          const mk = await getOrCreateMasterKey();
+          for (const [key, value] of Object.entries(installResult.outputs)) {
+            if (typeof value !== 'string') continue;
+            const encrypted = encryptSecret(value, mk);
+            const existing = db
+              .select()
+              .from(st)
+              .where(and(eq(st.moduleId, moduleId), eq(st.name, key)))
+              .get();
+            if (existing) {
+              db.update(st)
+                .set({
+                  encryptedValue: encrypted.encryptedValue,
+                  iv: encrypted.iv,
+                  authTag: encrypted.authTag,
+                  updatedAt: new Date(),
+                })
+                .where(eq(st.id, existing.id))
+                .run();
+            } else {
+              db.insert(st)
+                .values({
+                  moduleId,
+                  name: key,
+                  encryptedValue: encrypted.encryptedValue,
+                  iv: encrypted.iv,
+                  authTag: encrypted.authTag,
+                })
+                .run();
+            }
+            log.success(`Stored hook output: ${key}`);
+          }
+        }
       }
 
       // Transition to INSTALLED
@@ -1274,7 +1338,7 @@ async function deployModuleImpl(
       // host — the event path below only covers systems that deploy AFTER the
       // provider (deliveries bind at emit time). Non-providers skip this
       // entirely; their registration rides the system.created event below.
-      // v2/EVENT_DRIVEN_HOOK_SUBSCRIPTIONS.md.
+      // openspec/specs/event-driven-hook-subscriptions/spec.md.
       const { isDnsInternalProvider, backfillProviderDns, backfillWebRouteDns } = await import(
         './dns-provider-backfill'
       );
@@ -1304,8 +1368,8 @@ async function deployModuleImpl(
 
       // Announce each deployed system on the bus (D5/D6) — one
       // system.created.<module> per host, so a dns_internal provider's
-      // subscription registers every one (v2/MODULE_SYSTEMS_ADDRESSING.md,
-      // v2/INTERNAL_DNS_DHCP_AND_SPLIT_HORIZON.md, v2/EVENT_DRIVEN_HOOK_SUBSCRIPTIONS.md).
+      // subscription registers every one (openspec/specs/module-systems-addressing/spec.md,
+      // openspec/specs/internal-dns-split-horizon/spec.md, openspec/specs/event-driven-hook-subscriptions/spec.md).
       try {
         const { emitSystemCreated } = await import('./celilo-events');
         for (const sys of getModuleSystems(moduleId, db)) {
@@ -1323,7 +1387,7 @@ async function deployModuleImpl(
 
       // Fan out the module's base-module aspect (if any) per the
       // on_install trigger. Failures here don't fail the primary
-      // deploy — D4 in v2/CELILO_BASE.md: aspects are idempotent
+      // deploy — D4 in openspec/specs/base-module-aspects/spec.md: aspects are idempotent
       // and forward-progress; a partial fleet update is expected to
       // converge on the next fan-out. We log the result instead.
       const aspectOutcome = await maybeRunAspectForTrigger({
@@ -1340,6 +1404,27 @@ async function deployModuleImpl(
         log.success(`Base-module aspect fan-out for '${moduleId}' completed`);
       }
 
+      // A public_web provider deploy rebuilds its host and takes /srv/www with
+      // it, while consumers' route rows survive — so the fresh provider would
+      // render site blocks pointing at directories that no longer exist. Re-run
+      // each static consumer's on_install to refill them. Idempotent; failures
+      // are logged, never fatal to the provider's own deploy.
+      const republish = await republishStaticWebConsumers({
+        providerModuleId: moduleId,
+        manifest,
+        db,
+      });
+      if (republish.republished.length > 0) {
+        log.success(
+          `Re-published ${republish.republished.length} static site(s) to '${moduleId}': ${republish.republished.join(', ')}`,
+        );
+      }
+      for (const failure of republish.failures) {
+        log.warn(
+          `Failed to re-publish '${failure.moduleId}' to '${moduleId}': ${failure.error}. Run \`celilo module deploy ${failure.moduleId}\` to restore its content.`,
+        );
+      }
+
       log.success(`Module '${moduleId}' deployed successfully`);
       return {
         success: true,

package/src/services/module-subscriptions.ts

@@ -7,7 +7,7 @@
  *   - `$self` in `pattern`    → the module's id
  *   - `${MODULE_PATH}` in `handler` → the module's installed targetPath
  *   - a `hook:` subscription   → a synthesized `celilo events run-hook
- *     <module> <sub-name>` handler (v2/EVENT_DRIVEN_HOOK_SUBSCRIPTIONS.md)
+ *     <module> <sub-name>` handler (openspec/specs/event-driven-hook-subscriptions/spec.md)
  *
  * The bus subscriber's name is namespaced as `<module-id>.<sub-name>`
  * so two modules can declare a subscription named `smoke` without

package/src/services/module-types-generator.ts

@@ -11,7 +11,7 @@
  * output files; this module is responsible for the translation only, so
  * unit tests can exercise every branch without touching the filesystem.
  *
- * See `design/TECHNICAL_DESIGN_HOOK_API_V2.md` D2 for the design rationale.
+ * See `openspec/changes/hook-api-v2/proposal.md` D2 for the design rationale.
  */
 
 import type { ModuleManifest, VariableDeclare, VariableImport } from '../manifest/schema';

package/src/services/module-validator/git-hygiene.ts

@@ -94,7 +94,7 @@ export function checkGitHygiene(modulePath: string, versionSourceKind?: string):
   // `celilo module version` and ordered by the +N revision, so source moving
   // past the manifest is the NORMAL case, not drift; for pin modules the version
   // is checked against the upstream resolver, not git ancestry. Skip the gate for
-  // both (v2/MODULE_VERSIONING.md / ISS-0151).
+  // both (openspec/changes/module-version-semantics/proposal.md / ISS-0151).
   if (versionSourceKind === 'changeset' || versionSourceKind === 'pin') {
     checks.push({
       category: 'git_hygiene',